Search for a command to run...
Install the Elastic Stack 9.5 — Elasticsearch, Logstash and Kibana — from the official apt and rpm repositories, enable TLS security and ship your first logs.
The Elastic Stack is three products that work together: Elasticsearch stores and searches your data, Logstash ingests and transforms it, and Kibana visualises it.
Elasticsearch 9.5.5 · Logstash 9.5.5 · Kibana 9.5.5 · the
artifacts.elastic.co/packages/9.x repositories · security auto-configuration with TLS
and an enrollment token
Since 8.16 the default Elastic distribution is licensed under AGPL v3 (with source-available options for some features). If you need a permissive licence, use OpenSearch — it is API-compatible with the parts of Elasticsearch this guide covers and is licensed under Apache 2.0.
vm.max_map_count set to 262144 (Elasticsearch refuses to start otherwise)# 1. Import the Elastic signing key
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch \
| sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
# 2. Add the 9.x repository
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/9.x/apt stable main" \
| sudo tee /etc/apt/sources.list.d/elastic-9.x.list
# 3. Install the stack
sudo apt-get update
sudo apt-get install -y elasticsearch logstash kibana
# 4. Raise the memory map limit
sudo sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" | sudo tee /etc/sysctl.d/99-elastic.conf
sudo sysctl --system
# 5. Start the services
sudo systemctl daemon-reload
sudo systemctl enable --now elasticsearch
sudo systemctl enable --now kibana
sudo systemctl enable --now logstashThe old apt-key add command was removed in Debian 12 and Ubuntu 24.04. The key
now goes into /usr/share/keyrings/ and the repository references it with
signed-by=.
Elasticsearch 9 configures security automatically on first start: it generates TLS
certificates for the transport and HTTP layers, creates an enrollment token for Kibana and
enables the elastic superuser.
elastic passwordBecause the service runs under systemd, the password is not printed in the terminal. Set it with the reset tool:
cd /usr/share/elasticsearch
sudo -u elasticsearch bin/elasticsearch-reset-password -u elastic# Store it for the rest of the session
export ELASTIC_PASSWORD='the-password-you-just-set'curl --cacert /etc/elasticsearch/certs/http_ca.crt \
-u "elastic:$ELASTIC_PASSWORD" https://localhost:9200{
"name": "Cp8oag6",
"cluster_name": "elasticsearch",
"version": { "number": "9.5.5" },
"tagline": "You Know, for Search"
}# Get the enrollment token from Elasticsearch
cd /usr/share/elasticsearch
sudo -u elasticsearch bin/elasticsearch-create-enrollment-token --ca-fingerprint /etc/elasticsearch/certs/http_ca.crt# On the Kibana host, start Kibana with the token
sudo systemctl stop kibana
sudo /usr/share/kibana/bin/kibana \
--elasticsearch.hosts=https://localhost:9200 \
--elasticsearch.ssl.certificateAuthorities=/etc/kibana/config/http_ca.crt \
--elasticsearch.username=kibana_system \
--elasticsearch.password=<enrollment-token> \
--encryption.key="$(openssl rand -base64 32)" \
&The token is valid for 30 minutes. Kibana writes the security configuration to
/etc/kibana/kibana.yml, so this only has to be done once.
Create /etc/logstash/pipeline/logstash.conf:
input {
beats {
port => 5044
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
tag_on_failure => ["_syslog_parse_failure"]
}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "ISO8601" ]
}
}
}
output {
elasticsearch {
hosts => ["https://localhost:9200"]
user => "elastic"
password => "${ELASTIC_PASSWORD}"
ssl_certificate => "/etc/elasticsearch/certs/http_ca.crt"
index => "logs-%{+YYYY.MM.dd}"
}
stdout {
codec => rubydebug
}
}# Validate the pipeline before reloading
sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t
# Reload
sudo systemctl reload logstash
sudo journalctl -u logstash -fhttp://localhost:5601elastic and the password you setlogs-*# Check that Kibana is healthy
curl -s http://localhost:5601/api/status | jq .For a real cluster you need at least three master-eligible nodes:
# On the first node
sudo tee -a /etc/elasticsearch/elasticsearch.yml > /dev/null <<'EOF'
cluster.name: my-cluster
node.name: node-1
network.host: 0.0.0.0
transport.host: 0.0.0.0
discovery.seed.hosts: ["10.0.0.11", "10.0.0.12", "10.0.0.13"]
cluster.initial_master_nodes: ["node-1", "node-2", "node-3"]
EOF# On the other nodes, enrol them with a token (valid for 30 minutes)
sudo -u elasticsearch /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node
sudo -u elasticsearch /usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token>Leaving the bootstrap configuration in place means a restarted cluster can accidentally form a second cluster. Remove it once the nodes have joined.
elastic superuser and role-based access
are on by default in 9.x. Never disable them in production.curl -s --cacert /etc/elasticsearch/certs/http_ca.crt -u "elastic:$ELASTIC_PASSWORD" \
-X PUT "https://localhost:9200/_ilm/policy/logs_policy" -H 'Content-Type: application/json' -d '{
"policy": {
"phases": {
"hot": { "actions": { "rollover": { "max_primary_shard_size": "50gb" } } },
"delete": { "min_age": "30d", "actions": { "delete": {} } }
}
}
}'logstash.conf — use a keystore or environment
variables.Install Nagios Core 4.5.14 and the Nagios Plugins on Linux, configure hosts and services, and verify the checks that keep your infrastructure honest.
Set up Git and the GitHub and GitLab command line clients with authentication, branching strategies, credential helpers and the everyday commands every DevOps engineer relies on.